CVE-2026-90273: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
In the Linux kernel, the following vulnerability has been resolved:
coresight: etm4x: missing cscfgcsdevdisableactiveconfig() in perf enable
In the perf enable path, there are missing cases where cscfgcsdevdisableactiveconfig() is not called:
- Branch broadcast is selected but not supported by the hardware - etm4enablehw() fails
This can lead to a leak of configdesc->activecnt. Fix this by properly calling cscfgcsdevdisableactiveconfig() in these error paths.
Event History
Frequently Asked Questions
Under what conditions can the configuration reference count leak?
The leak can occur in the perf enable path when branch broadcast is selected but unsupported by the hardware, or when etm4_enable_hw() fails. In those error paths, the active configuration was not disabled, leaving config_desc->active_cnt incremented.
What is the effect of the fix?
The fix calls cscfg_csdev_disable_active_config() in the affected perf enable error paths. This ensures config_desc->active_cnt is decremented when enabling cannot proceed.